Seong-Je Cho

Large language model (LLM)-based agents are evolving into agents for computer use (ACUs) that read files, invoke applications, communicate over networks, and operate graphical interfaces, moving the effective security boundary from model inputs and outputs to autonomous actions that alter endpoint state. Conventional identity and access controls remain applicable and necessary, but they are authorized based on identity, resource, and network policy rather than on the semantic scope of the active task or the provenance of the instruction that triggered an action. This paper presents ARES (Agent Resource Enforcement and Security), an action-centric framework that inserts enforceable authorization between agent-generated tool calls and protected resources, combining a Resource Proxy Layer for interception, a Behavioral Guardrail Engine for task- and context-aware authorization, and a Multi-Agent Trust Boundary Manager for provenance and taint propagation. We implement ARES-lite and evaluate it against file exfiltration through indirect prompt injection, prompt infection propagation, and internal-network access abuse. Under the controlled replay-based evaluation, integrated ARES-lite reduced the observed attack-success rate from 100% under the permissive baseline to 0% across the three evaluated scenarios, while preserving the predefined handling of eight benign and ambiguous tasks with no false positives. A closed-loop evaluation in which the agent re-plans after an intervention, an adversarial boundary-case suite covering path aliasing, address encoding, look-alike destinations, and taint laundering, and a comparison against representative prompt-filtering and tool-allowlist defenses further characterize the enforcement path; a model and temperature sweep show that baseline exposure varies with model capability, whereas the mediated outcome does not.

Large language model (LLM)-based agents are evolving from conversational assistants into agents for computer use (ACUs) that read files, invoke applications, communicate over networks, and operate graphical interfaces. This transition moves the effective security boundary from model inputs and outputs to autonomous actions that alter endpoint state. Existing controls, including prompt filters, tool allowlists, network data loss prevention, and endpoint monitoring, provide only partial protection because they do not jointly evaluate task intent, resource sensitivity, destination trust, and the provenance of instructions propagated across agents. This paper presents ARES (Agent Resource Enforcement and Security), an action-centric endpoint security framework that inserts enforceable authorization between agent-generated tool calls and protected resources. ARES combines a Resource Proxy Layer for resource-specific interception, a Behavioral Guardrail Engine for task- and context-aware authorization, and a Multi-Agent Trust Boundary Manager for provenance and taint propagation. We implement ARES-lite with file and network proxies, deterministic pre-execution policies, inter-agent taint tracking, and structured audit logging, and evaluate it in a controlled synthetic workspace against file exfiltration through indirect prompt injection, prompt infection propagation, and internal-network access abuse. The integrated design interrupts the evaluated attack paths while preserving expected benign handling with low measured local decision latency in the controlled prototype, supporting action-centric mediation as a practical complement to prompt-centric safeguards.

Industrial control systems (ICSs) are increasingly interconnected with enterprise IT networks and remote services, which expands the attack surface of operational technology (OT) environments. However, collecting sufficient attack traffic from real OT/ICS networks is difficult, and the resulting scarcity and class imbalance of malicious data hinder the development of intrusion detection systems (IDSs). At the same time, large language models (LLMs) have shown promise for security analytics when system events are expressed in natural language. This study investigates an LLM-based network IDS for a smart-factory OT/ICS environment and proposes a synthetic data generation method that injects domain knowledge into attack samples. Using the ICSSIM simulator, we construct a bottle-filling smart factory, implement six MITRE ATT&CK for ICS-based attack scenarios, capture Modbus/TCP traffic, and convert each request–response pair into a natural-language description of network behavior. We then generate synthetic attack descriptions with GPT by combining (1) statistical properties of normal traffic, (2) MITRE ATT&CK for ICS tactics and techniques, and (3) expert knowledge obtained from executing the attacks in ICSSIM. The Llama 3.1 8B Instruct model is fine-tuned with QLoRA on a seven-class classification task (Benign vs. six attack types) and evaluated on a test set composed exclusively of real ICSSIM traffic. Experimental results show that synthetic data generated only from statistical information, or from statistics plus MITRE descriptions, yield limited performance, whereas incorporating environment-specific expert knowledge is associated with substantially higher performance on our ICSSIM-based expanded test set (100% accuracy in binary detection and 96.49% accuracy with a macro F1-score of 0.958 in attack-type classification). Overall, these findings suggest that domain-knowledge-infused synthetic data and natural-language traffic representations can support LLM-based IDSs in OT/ICS smart-factory settings; however, further validation on larger and more diverse datasets is needed to confirm generality.

Many machine learning–based Android malware detection often suffers from concept drift, where models trained on historical data fail to generalize to evolving threats. This paper proposes SCAN (Structural Clustering with Adaptive thresholds for iNtelligent Android malware detection), a hybrid intelligent framework designed to mitigate concept drift without retraining. SCAN integrates Gaussian Mixture Models (GMMs)-based clustering with cluster-wise adaptive thresholding and supervised classifiers tailored to each cluster. A key challenge in clustering-based malware detection is cluster-wise class imbalance, where clusters contain disproportionate distributions of benign and malicious samples. SCAN addresses this issue through adaptive thresholding, which dynamically adjusts the decision boundary of each cluster according to its malicious-to-benign ratio. In the final training stage, four supervised learning algorithms—Random Forest (RF), Support Vector Machine (SVM), k-NN, and XGBoost—are applied within the GMM-defined clusters. We train SCAN on Android applications collected from 2014–2017 and test it with applications from 2018–2023. Experimental results demonstrate that SCAN combined with RF consistently achieves superior performance, with both average accuracy and average F1-score exceeding 91%. These findings confirm SCAN’s robustness to concept drift and highlight its potential as a sustainable and intelligent solution for long-term Android malware detection in the real world.

Industrial control systems (ICSs) are increasingly interconnected with enterprise IT networks and remote services, which expands the attack surface of operational technology (OT) environments. However, collecting sufficient attack traffic from real OT/ICS networks is difficult, and the resulting scarcity and class imbalance of malicious data hinder the development of intrusion detection systems (IDSs). At the same time, large language models (LLMs) have shown promise for security analytics when system events are expressed in natural language. This study investigates an LLM-based network IDS for a smart-factory OT/ICS environment and proposes a synthetic data generation method that injects domain knowledge into attack samples. Using the ICSSIM simulator, we construct a bottle-filling smart factory, implement six MITRE ATT&CK for ICS based attack scenarios, capture Modbus/TCP traffic, and convert each request–response pair into a natural-language description of network behavior. We then generate synthetic attack descriptions with GPT by combining (1) statistical properties of normal traffic, (2) MITRE ATT&CK for ICS tactics and techniques, and (3) expert knowledge obtained from executing the attacks in ICSSIM. The Llama 3.1 8B Instruct model is fine-tuned with QLoRA on a seven-class classification task (Benign vs. six attack types) and evaluated on a test set composed exclusively of real ICSSIM traffic. Experimental results show that synthetic data generated only from statistical information or from statistics plus MITRE descriptions yield limited performance, whereas incorporating environment-specific expert knowledge enables the model to achieve 99.61% accuracy in binary detection and 95.63% accuracy with a macro F1-score of 0.952 in attack-type classification. These results demonstrate that domain-knowledge–infused synthetic data and natural-language traffic representations can make LLM-based IDSs a practical option for deployment in OT/ICS smart-factory environments.

The rapid increase in smartphone usage has led to a corresponding rise in malicious Android applications, making it important to develop efficient and sustainable malware detection methods with high accuracy. This paper presents a two-stage machine learning approach aimed at improving both detection accuracy and sustainability in Android malware classification. The first stage estimates the release year of an app using its SDK version information, while the second stage classifies apps as benign or malicious through a weighted voting mechanism applied to year-specific malware detection models. This method balances the high accuracy of retraining with reduced computational overhead, delivering robust and scalable malware detection. Using a dataset spanning 2014 to 2023, we evaluate the performance of the proposed method in comparison to retraining and incremental learning approaches. Experimental results demonstrate that while the retraining method achieves the highest accuracy and F1 score, it incurs a significant increase in training time. Conversely, the incremental learning method offers lower accuracy but reduced training time. Our two-stage classification method effectively balances these trade-offs, providing accuracy comparable to retraining while maintaining stable training times and moderate model sizes, making it a viable option for sustainable malware detection in real-world environments. Future research will explore non-machine-learning-based release year prediction methods to further optimize training efficiency and improve adaptability to the rapidly evolving malware detection landscape.